PT-2026-31034 · WordPress · Wordpress+1

Darkestmode

·

Published

2026-04-07

·

Updated

2026-04-08

·

CVE-2026-4065

CVSS v3.1

5.4

Medium

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions Smart Slider 3 plugin for WordPress versions up to and including 3.5.1.33
Description The Smart Slider 3 plugin for WordPress is susceptible to unauthorized data access and modification. This is due to the absence of capability checks in multiple wp ajax smart-slider3 controller actions. The display admin ajax() method lacks a call to checkForCap(), which requires unfiltered html capability. Several controller actions only validate the nonce (validateToken()) without validating permissions. This allows authenticated attackers with Contributor-level access or higher to enumerate slider metadata and create, modify, and delete image storage records by leveraging the nextend nonce exposed on post editor pages.
Recommendations Update to a version beyond 3.5.1.33

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-4065

Affected Products

Smart Slider 3
Wordpress